CVE-2026-25712: Gitea organization permission APIs expose private visibility information
Published Jul 3, 2026
·Updated
Gitea versions before 1.25.5 have insufficient visibility checks in organization permission APIs for hidden members and private organizations.
Affected Software
1 affected component
Gitea Gitea<1.25.5
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
giteato a version that resolves this vulnerability.Fixed in 1.25.5
Event History
Jul 3, 2026
CVE Published
via MITRE·08:19 PM
Data Sourced
via MITRE·08:19 PM
DescriptionWeakness
Data Sourced
via NVD·09:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2026-25712?
CVE-2026-25712 has a risk score of 33, indicating a moderate level of severity.
2
How do I fix CVE-2026-25712?
To fix CVE-2026-25712, upgrade Gitea to version 1.25.5 or later.
3
What does CVE-2026-25712 vulnerability affect?
CVE-2026-25712 affects Gitea versions prior to 1.25.5, specifically in the organization permission APIs.
4
What information is exposed by CVE-2026-25712?
CVE-2026-25712 exposes private visibility information of hidden members and private organizations.
5
When was CVE-2026-25712 published?
CVE-2026-25712 was published on July 3, 2026.